data security ai_generated true

Excel executes formulas when opening CSV exported from web application, enabling code execution

ID: data/csv-formula-injection

Also available as: JSON · Markdown
90%Fix Rate
92%Confidence
3Evidence
2023-01-01First Seen

Version Compatibility

VersionStatusIntroducedDeprecatedNotes
any active — — —

Root Cause

CSV cells starting with =, +, -, @ are interpreted as formulas by Excel/Google Sheets. Exported user data containing '=HYPERLINK(evil_url)' or '=CMD|...' executes code when opened. OWASP lists this as an injection vulnerability.

generic

Workarounds

  1. 90% success Prefix dangerous cells with a single quote or tab character 
    if cell.startswith(('=', '+', '-', '@')): cell = "'" + cell  # single quote prevents formula execution
  2. 88% success Wrap all cell values in double quotes and prepend space to formula-like values 
    if cell.lstrip().startswith(('=', '+', '-', '@', '\t', '\r')): cell = ' ' + cell
  3. 82% success Serve CSV with Content-Type: text/csv and Content-Disposition: attachment to prevent browser rendering 
    response.headers['Content-Type'] = 'text/csv'; response.headers['Content-Disposition'] = 'attachment; filename=export.csv'

Dead Ends

Common approaches that don't work:

  1. Sanitize CSV output by HTML-encoding special characters 85% fail

    HTML encoding doesn't help - Excel doesn't interpret HTML entities. The formula characters =+- must be escaped differently for CSV.

  2. Assume CSV is 'just text' and doesn't need sanitization 92% fail

    Spreadsheet applications auto-execute formulas. A cell starting with = is executed, even if it came from user input.